Date: Sun, 15 Apr 2012 15:51:24 +0400 From: Gleb Smirnoff <glebius@FreeBSD.org> To: freebsd-pf@FreeBSD.org Cc: bug-followup@FreeBSD.org Subject: Re: kern/164402: [pf] pf crashes with a particular set of rules when first matching packet arrives Message-ID: <20120415115124.GO9391@FreeBSD.org> In-Reply-To: <201204151110.q3FBA3Fr034331@freefall.freebsd.org> References: <201204151110.q3FBA3Fr034331@freefall.freebsd.org>
next in thread | previous in thread | raw e-mail | index | archive | help
On Sun, Apr 15, 2012 at 11:10:03AM +0000, Gleb Smirnoff wrote:
T> I have a vague suspicion on what is happening. Your description of
T> the problem looks like if a packet processing in the kernel has entered
T> an endless loop.
T>
T> Looking at pf_route() I see such possibility. From OpenBSD we have
T> this protection against endless looping:
T>
T> if ((*m)->m_pkthdr.pf.routed++ > 3) {
T> m0 = *m;
T> *m = NULL;
T> goto bad;
T> }
T>
T> In our code this transforms to:
T>
T> if (pd->pf_mtag->routed++ > 3) {
T> m0 = *m;
T> *m = NULL;
T> goto bad;
T> }
T>
T> The root difference between storing the tag on mbuf and on pfdesc
T> is that we lose pfdesc, and thus the tag, when we enter pf_test()
T> recursively. And pf_route() does this recursion:
T>
T> if (oifp != ifp) {
T> if (pf_test(PF_OUT, ifp, &m0, NULL) != PF_PASS) {
T> goto bad;
T> ....
On second look I see that my suspicion may not be true. In the
beginning of pf_test() we do pf_get_mtag() which preserves already
present tag if there is one.
--
Totus tuus, Glebius.
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20120415115124.GO9391>